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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
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closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 
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DETAILED ACTION 

Claims 1-20 are pending for examination. 

Priority 

1 . Receipt is acknowledged of papers submitted under 35 U.S.C. 1 19(a)-(d), which 
papers have been placed of record in the file. The effective filing date for the subject 
matter defined in the pending claims in this application is May 17, 2000 as per foreign 
application 0011935.4 (United Kingdom). 



Claim Rejections - 35 USC §112 

2. Claim 17 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
in that it fails to point out what is included or excluded by the claim language. This claim 
is an omnibus type claim. 



Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1 ), (2), and (4) of section 371 (c) of this 
title before the invention thereof by the applicant for patent. 
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The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act 
of 1999 (AIPA) and the Intellectual Property and High Technology Technical 
Amendments Act of 2002 do not apply when the reference is a U.S. patent resulting 
directly or indirectly from an international application filed before November 29, 2000. 
Therefore, the prior art date of the reference is determined under 35 U.S.C. 102(e) prior 
to the amendment by the AIPA (pre-AlPA 35 U.S.C. 102(e)). 

4. Claims 1-9, 11-13, 15, 16 and 18-20 are rejected under 35 U.S.C. 102 (e) as 
being anticipated by Walker et al., US Patent No. 6,061 ,723 

5. In referring to claim 1, Walker et al discloses a network management apparatus 
that has a method (Fig. 1 netmon which resides on the network management station 
(NMS) and polls a plurality of network interfaces associated with a plurality of network 
elements on the network through interface N.1) for identifying an event (poll failure from 
a broken network element - a broken element is termed a criticalFailure and is the root 
cause of the plurality of events in the criticalRoute path) among a plurality of events (poll 
failures from inaccessible network elements; poll failures from broken network elements 
and successful polls) detected by a network management station (110, Fig. 1) on a 
network (100, Fig. 1), which event is indicative of the underlying cause (broken network 
element in a criticalRoute) of more than one of said plurality of events, wherein the 
network management station knows the topology (netmon discovers the topology of the 
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network) of the network (Fig. 1 , and col. 5, line 35 through col. 6 line 28), comprising the 
steps of: 

□ considering the Ideation (analyzes the status of interfaces along the 
critical Route) of the network device causing each event in the plurality of 
events (col. 7, lines 21-25), 

□ and determining as said event, the event which has occurred at a location 
closest (Note: The primary failure event is inherently closest, to the NMS 
because all other failures on the same critical path are considered 
secondary. The secondary failure devices are inaccessible due to the 
failure of the primary device. Therefore, the secondary failure devices 
inherently come after the primary failure device along the critical path) to 
the network management station (Fig. 1 and col. 7, lines 25-67) 

6. In referring to claim 2, Walker et al Further discloses: 

□ a method as claimed in claim 1, wherein the step of considering the 
location comprises, for each event in the plurality of events, determining 
the number of devices and/or links (When netmon's ping of interface C.2 
times-out, netmon examines the in-memory status of every interface along 
the critical path, starting at the NMS and progressing to interface C.2 that 
is causing the event. Each interface is part of the associated device and 
the link connecting it to other devices or to the network) between the 
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device causing the event and the network management station (Fig. 5, 
and col. 7, lines 47-53). 



7. In referring to claim 3, Walker et al further discloses: 

□ A method as claimed in claim 2, wherein the step of determining the 
number of devices and/or links between the device causing the event and 
the network management station comprises the steps of: determining the 
shortest path (The critical path can be computed even if the network 
contains loops because at the moment the computation is performed, 
there is only one route that a packet would take - this is inherently the 
shortest path) between the device causing the event and the network 
management station using the topology of the network and calculating the 
number of devices and/or links (Precedence is given to routes within the 
same network or subnet, and routes containing router nodes. Routers 
uses the number of links when calculating the path to a destination) in the 
determined shortest path (col. 6, lines 49-56). 



8. In referring to claim 4, Walker et al further discloses: 

□ A method as claimed in claim 2, further comprising the step of: receiving 
each event, and automatically determining (The topology is known, 
therefore netmon can automatically determine the number of interfaces) 
the number of devices and/or links (interfaces in the critical path) between 
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the device causing the event and the network management station (col. 6, 
lines 22-48). 

9. In referring to claim 5, Walker et al further discloses: 

□ A method as claimed in claim 4, further comprising storing (examines the 
in-memory status of every interface) the determined number of devices 
and/or links (interfaces) between the device causing the event and the 
network management station for each event (col. 7, lines 47-59). 

10. In referring to claim 6, Walker et al further discloses: 

□ A method as claimed in claim 2, wherein the step of determining as said 
event comprises the step of: selecting as the event, the event for which 
the number of devices and/or links (interfaces along the critical path) 
between the device causing the event and the network management 
station, is the fewest (The algorithm will go through all the interfaces in the 
critical path once a poll has timed out and find the first interface failure in 
the path from the NMS to the failing interface. This will result in the fewest 
devices and/or links) (col. 6, line 36 through col. 7 line 45). 

11. In referring to claim 7, Walker et al further discloses: 

□ A method as claimed in claim 1 , wherein prior to the step of considering, 
the method comprises the step of: determining if said plurality of events 
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are related (if any interface along this path is Down), and if it is determined 
that said plurality of events are related (secondaryFailure - these 
interfaces are not the actual cause of the time-out pings, they are a 
symptom of the actual cause), storing said plurality of related events in an 
event list (slowPingList) (col. 7, lines 47-59). 

12. In referring to claim 8, Walker et al further discloses: 

□ A method as claimed in claim 7, wherein the step of determining if the 
plurality of events are related comprises determining the type (Not failing; 
Primary Failure and Secondary Failure. The not failing ping represents 
interfaces that are functioning normally; the Primary Failure events 
represent a critical failure where the actual hardware or software has 
failed and the Secondary Failure events represent interfaces that are 
failing because of the critical failure) of event for each of the plurality of 
events, and determining that said plurality of events are related if the 
events are of a similar type (col. 7, lines 32-45. Failure Classification list). 



1 3. In referring to claim 9, Walker et al further discloses: 

□ A method as claimed in claim 7, wherein the method further comprises: 
receiving each event; and the step of determining if said plurality of events 
are related comprises the steps of: for each event, determining the time 
difference (this is automatic as the ping timeout value determines how 
long to wait for a response before a timeout event occurs) between the 
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time of the received event (ping response) and the time of the immediately 
preceding event (ping) (col. 8, lines 12-17), 
□ and determining that the received event is related to the immediately 
preceding event if the time difference is less than a predetermined time 
(ping time-out value) period (col. 8, lines 12-23). 



14. In referring to claim 1 1 , Walker et al further discloses: 

□ A method as claimed in claim 9, wherein, if the received event is 
determined to be related, the method further comprises the step: of storing 
the event in a list of related events (the following lists are maintained: the 
normal pingList; slowPingList and criticalRouteWaitList), and if the 
received event is determined not to be related (When netmon's ping of 
interface C.2 times-out), the method further comprises the steps of: 
comparing (examines) the type of events in the existing list of related 
events, and selecting events of a similar (secondary failure interfaces), 
relevant type (Critical failure - this is the first failure in the critical path and 
it is the relevant interface to examine) (col. 7, line 32 through col. 8, line 
4). 



1 5. In referring to claim 12, Walker et al further discloses: 

□ A method as claimed in claim 7, wherein the method further comprises: 
receiving each event; and the step of determining if said plurality of events 
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are related comprises the steps of: for each event, comparing the type of 
the received event (interfaces are UP - poll/ping successful for interface 
A.1) and the type of the immediately preceding event (poll), and 
determining that the received event is related to the immediately 
preceding event if the step of comparing (No interface Down events) finds 
the event type (response not a time-out) of the received event is similar to 
the event type (poll) of the immediately preceding event (col. 6, line 65 
through col. 7, Iine15). 

16. In referring to claim 1 3, Walker et al further discloses: 

□ A method as claimed in claim 7, wherein the method further comprises: 
receiving each event; and the step of determining if said plurality of events 
are related comprises the steps of: for each event, determining the time 
difference between the time of the received event (ping response) and the 
time of the immediately preceding event (ping), and comparing the type of 
the received event (ping response) and the type of the immediately 
preceding event (ping), and determining that the received event is related 
to the immediately preceding event if the time difference is less than a 
predetermined time period (ping time-out value) and the events are similar 
in type (ping and ping response) (col. 8, lines 12-23).. 



17. 



In referring to claim 15, Walker et al further discloses: 
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□ A method as claimed in claim 7, further comprising the steps of, receiving 
each event; automatically determining if the event is related to the 
immediately preceding event (ping and ping responses are automatically 
related events), and if it is determined that the received event is related 
(no time-out), storing the received event in the event list (normal pingList) 
(col. 7 line 47 through col.8 line 4). 



1 8. In referring to claim 16, Walker et al further discloses: 

□ A method as claimed in claim 15, wherein, if it is determined that the event 
is not related (interface C.2 is inaccessible because of a ping time-out) to 
the immediately preceding event (ping), the method further comprises 
storing the received event in a new event list (a new queue called the 
critical-RouteWaitList) (col. 7 line 47 through col.8 line 4). 



19. In referring to claim 20, Walker et al further discloses: 

□ A network management apparatus for managing a network, comprising a 
network management station (110, Fig.1) having a processor (No details 
was given for the network management station, but US Patent 5,185,860 
Fig, 1, which is incorporated into this patent by reference, shows a 
processing element) and memory (topology Database in Fig. 1), the 
memory storing data representing the topology of the network (Fig. 1 and 
col. 5, lines 35-51), 
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□ wherein the network management station is configured to monitor 
(network monitor) the network and to generate events (periodically polling) 
in finding predefined event conditions (not responding to a poll); wherein 
the network management station is further configured to identify (Not 
Failing; Primary Failure and Secondary Failure) an event among a plurality 
of events generated by the network management station (col. 5, lines 41- 
63 and col. 7, lines 32-45), 

□ which event is indicative of the underlying cause (the primaryFailure 
interface is the underlying cause because its own Hardware or Software 
failed) of more than one of said plurality of events, by considering the 
location (analyzes the status of interfaces along the critical path) of the 
network device causing each event in the plurality of events, and 
determining as said event, the event which has occurred at a location 
closest (Note: The primary failure event is inherently closest, to the NMS 
because all other failures on the same critical path are considered 
secondary. The secondary failure devices are inaccessible due to the 
failure of the primary device. Therefore, the secondary failure devices 
inherently come after the primary failure device along the critical path) to 
the network management station (col. 7, lines 8-60). 



20. Claims 1 8 and 1 9 are similar in scope as of claim 1 , therefore claims 1 8 and 1 9 
are rejected for the reason set forth above in paragraph 5 for claim 1 . 
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Claim Rejections - 35 USC § 103 



21 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

22. Claim 10 is rejected under 35 U.S.C. 103(a) as being unpatentable over Walker 
et al. t in view of Moghe, US Patent 6,173,323. 

23. Although the system disclosed by Walker et al., shows substantial features of the 
claimed invention (discussed above), Walker et al., does not explicitly disclose the 
predetermined time between a received event and the immediately preceding event as 
being in the range of 0 seconds to 5 minutes. 

24. In an analogous art, Moghe discloses an adaptive polling rate algorithm for 
network monitoring that starts at an initial rate of 10 seconds and increases to 80 
seconds (1.33 minutes which is within the 0 seconds to 5 minutes range) (col. 2, lines 
23-38). Moghe further states: " These initial parameters are typically based on 
engineering criteria" (col. 2, lines 27-28). Criteria can be the size of the network; the 
speed of the links etc., which can increase the initial rate from 10 seconds to a larger 
number. 
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25. At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to combine the polling rate of Moghe with Walker et al. The suggested 
motivation for doing so would have been to adapt the polling scheme to take into 
account the network traffic congestion due to failures in the network. 

Therefore, it would have been obvious to combine Walker et al., with Moghe to 
obtain the invention as claimed in claim 10. 

26. Claim 14 is similar in scope as of claim 10, therefore claim 14 is rejected for the 
reasons set forth above in paragraphs 23 - 25 for claim 1 0. 



Conclusion 

27. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

□ Wu, U.S. Patent 5,185,860. Wu discloses a computer network node 
discovery system that provides a general way of discovering network 
elements, or nodes, connected to a computer network. 

□ Besaw et al., U.S. Patent 5,276,789. Besaw et al. disclose a system for 
automatically laying out and graphically displaying the topology of a 
computer network. 



Application/Control Number: 09/691,649 



Page 14 



Art Unit: 2153 

28. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Noel K Singh whose telephone number is (703)305- 
4651. The examiner can normally be reached on 8 A.M. to 5 P.M.. 
If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Glenton B Burgess can be reached on (703)305-4792. The fax phone 
numbers for the organization where this application or proceeding is assigned are 
(703)305-7201 for regular communications and (703)305-7201 for After Final 
communications. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703)305- 
3900. 





September 2, 2003 
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